JDK-8256659 : Incorrect parsing of krb5 username
  • Type: Bug
  • Component: security-libs
  • Sub-Component: org.ietf.jgss:krb5
  • Affected Version: 8u271
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • Submitted: 2020-11-19
  • Updated: 2021-02-15
  • Resolved: 2021-02-15
Related Reports
Duplicate :  
Relates :  
Relates :  
Description
Kerberos app regression. Works on Oracle 8u261 but fails on Oracle 8u271

We upgraded java jdk from 1.8-261 to 1.8-271 on an application server (RedHat
Enterprise Linux 7) running EAP Jboss 7.1.6  and since that the Kerberos
authentication with AD has issues. In the process a string parsing seems not
work correctly.

I compared the log entries on the security with java 1.8.261 vs. 1.8.271 and
I stumbled on the following issue:

Java 1.8.261:
- [org.jboss.security.auth.spi.AbstractServerLoginModule][login] Storing
username 'TESTUSER' and empty password

Java 1.8.271:
- [org.jboss.security.auth.spi.AbstractServerLoginModule][login] Storing
username 'TESTUSER\' and empty password

The "\" seems to be bug on my perspective on their implementation of the
AdvanceLdapLogin Module or similar. The system cannot find the username with
an ending "\" on the ldap server.

We set debug to true on Krb5LoginModule and set the system properties
sun.security.krb5.debug=true and sun.security.spnego.debug=true
Please find attached the krb5.conf and the logs.
Comments
Submitter got back to say that Jboss authentication mechanism was altered to work around this issue. Not conclusive if porting of Microsoft MS-SFU extensions enhancement would help in this specific scenario. I'll close this bug but will continue to look at porting JDK-8005819 to Oracle JDK Updates.
15-02-2021

Red Hat analysis suggests that lack of Microsoft MS-SFU extensions in JDK krb5 support is the reason for the JBoss issue. Will investigate how this enhancement can be applied to the Oracle JDK 8u releases.
18-01-2021